About snehal8

snehal8 · ‎09-30-2021

Its can contain the IP address or if its empty then it contain "NOT_AVAILABLE". Please do let me know if it help.

snehal8 · ‎09-30-2021

whenever there is no data in logs its represent as "NOT_AVAILABLE" entry. Please do consider this in regex as well.

snehal8 · ‎09-29-2021

Thank you for the reply. The event should be broken by follows 1st Event 122.0.0.2 NOT_AVAILABLE abc Agent= 2021-09-27 11:15:39 5648 WARN xyz 2nd Event NOT_AVAILABLE NOT_AVAILABLE NOT_AVAILABLE NOT_AVAILABLE 2021-09-27 11:16:08 5432 DEBUG Field: xyz - value: ID - unformatted value: vvcsa - formatted value: abcsc - returnType: - boost: 1 - append: False

snehal8 · ‎09-29-2021

Hello All, Can any one help me on this event injection in Splunk. sample data 122.0.0.2 NOT_AVAILABLE abc Agent= 2021-09-27 11:15:39 5648 WARN xyz NOT_AVAILABLE NOT_AVAILABLE NOT_AVAILABLE NOT_AVAILABLE 2021-09-27 11:16:08 5432 DEBUG Field: xyz - value: ID - unformatted value: vvcsa - formatted value: abcsc - returnType: - boost: 1 - append: False Here it have to be two events with respective date time.

snehal8 · ‎02-23-2015

Hello Everyone, I need to forward IIS logs from one of my hosts, so wrote inputs.conf in deployment server and deployed it to the host. The normal IIS logs were forwarded, but the PingFederate IIS logs were not. So i tried with this two thinks [WinEventLog://Application] disabled = 0 [WinEventLog://Security] disabled = 0 [WinEventLog://System] disabled = 0 [WinEventLog://d:\PingFederate\PingIISAgent.evtx] disabled = 0 Here, all logs come in except d:\PingFederate\PingIISAgent.evtx so I tried adding monitor instead of WinEventLog , but I received data that wasn't human readable. Please can anyone help me on this? Where am I going wrong? Thanks

snehal8 · ‎02-11-2015

Thanks for reply @aakwah, but when i searched for index=_audit "mysearch name" "*delete*" its displaying log for my this search string, please guide me if am going wrong ?

snehal8 · ‎02-11-2015

Hello All, We have two search head, three indexers clustered, a cluster master, and a deployment server. All running Windows 2k8 R2. We are finding some alerts are deleted form search head, and need to investigate log files to monitor which user deleted, when and so on. Cloud you please guide me how to figure out this? Thanks.

snehal8 · ‎02-11-2015

Hello All, Thanks for your reply, the problem was Account string contain the two values with line break. so i used mvjoin command to remove line and now it is working perfectly fine. Once again thanks all !!

snehal8 · ‎02-11-2015

Thanks for reply @ramdaspr. the problem was this string it contain line break, so it was not coming. i used "mvjoin" command for removing line. that it worked !!! 🙂

snehal8 · ‎02-10-2015

Thanks for reply @kendrickt.. same not getting display !!!

snehal8 · ‎02-10-2015

Thanks for reply @mzorzi. but it is not working.

snehal8 · ‎02-10-2015

Hello Everyone, I have a file containing Account ="xxx/\xxx/\xxx/\xx" value and this needs to be concatenated with a string, say "my account" . when i tried following search: index=myindex | eval description= "my account" + Account | table description getting blank for "description" . Can any one guide me where aI'm going wrong ??? or this is because of the "/\" character in the string? Thanks

snehal8 · ‎01-29-2015

Thanks for reply @mzorzi. in search it is not showing , but when i executing this query " index=_internal (host=*xxx* OR host=*xxx*) NOT (series=_* OR series=*summary*) source=*metrics.log group=per_index_thruput earliest=-7d | timechart span=1d sum(eval(kb/1024)) AS "MB indexed" by series " , then its showing index a with amount of data. then if it in "_internal" ? then how to move this data in my actual index b ? please help me on this

snehal8 · ‎01-29-2015

Hello Everyone, I have created an inputs.conf file for deploying an app in host machine to forward data. [monitor:///xxxxxx] index=a disabled=false sourcetype=Test but have created an index called b and by mistake, in the inputs.conf file mentioned a, so data is came in splunk with this index but not getting where is exactly store. Where exactly is the data sent in this scenario? How can I resolve this? Thanks.

snehal8 · ‎01-19-2015

Thanks @somesoni will use this.

snehal8 · ‎01-19-2015

Thanks @lguinn now i understand 🙂

snehal8 · ‎01-16-2015

Thank you @lguinn, but i am not getting mean of this "Today=if(_time>relative_time(now(),"@d"),"Today","PriorWeek")", in this "PriorWeek", is this predefined? please could you give me detail it will be grateful. thanks

snehal8 · ‎01-14-2015

Hello Everyone, I want to trigger an alert with a list of hosts that are sending more data compared to the Average of all hosts from the previous week. Eg: The week start from Mon-Sunday has Average(divided by 7) data per host and have added 50% threshold (to compare if its increase is more than this to triggered the alert) HostA: 10mb + 5 (50 %) HostB: 5mb + 2.5(50%) HostC: 1mb + 0.5(50%) and Yesterday the hosts status are HostA: 2mb HostB: 4mb HostC: 2mb I have this search query which will get the hosts sending data more today index=* earliest=-5m | eval esize=len(_raw) | stats count max(esize) by host, source | top host | fields - count but I don't know how to write it for the above scenario. Can any one help me on this. Thanks

snehal8 · ‎05-09-2013

Hello All, I am passing state variable to another form called CityName. My drilldown is as follows: /app/demoapp/CityName?form.Subscriber_State=$click.value$ My CityName Form: Landing page for dynamic drilldown example index=myindex Subscriber_State="$Subscriber_State$" | table Subscriber_City where Subscriber_State is variable. When i click to my state its opening new tab and giving this error: Unexpected query string parameters: form.Subscriber_State Please can any one help me on this. thank you

snehal8 · ‎05-09-2013

Can any one please Help me one this how to get this. without using of sideview app.

snehal8 · ‎05-08-2013

Thanks for reply.Still i not used sideview .can you please tell me how to use URLloader in my example.

snehal8 · ‎05-08-2013

Hello All, I am trying to pass value to one view to other.for that i did xml as follows: Created View Called CityName and wrote xml as follows: Search activity overview Top Cites (last 24 hours) index="myindex" Subscriber_State=$US_State$| table Subscriber_City Where US_state is variable pass by another view. that is: It is Tag in /app/myapp/CityName?view.US_State=$click.value$ Can any one tell me where i am going wrong. Thank you

snehal8 · ‎04-08-2013

Sample Example Script Name : xyz0101.ksh Start Time : 2012-12-09 16:40:27 Arguments : Env Variables : Some lines here PL/SQL procedure successfully completed. error code is 0 End Time : 2012-12-09 18:47:15 Return Code = 0 (Normal Termination, Continue Processing) I want to extract start time and end time and error code in single table. I was able to extract StartTime but not Endtime,Return code in regex window

snehal8 · ‎04-08-2013

Hello Everyone I am working with three different files.Each file has different start time and end time.that all files is in one index. my problem is when i am extracting field that is start time initial its taking only that time but when i came to search app that is table start time then its taking hole lines whichever its come after the starttime regex for starttime is (?i) Time : (?P .+) Another problem that is my each file has more lines in that.so when i come for extracting field as end time is in last line so i am not able to see that in my extraction form. can any one help me on this. thank you

snehal8 · ‎04-05-2013

Thank you.

Posts	26
Solutions	1
Karma Given	8
Karma Received	3
Member Since	‎03-15-2013

Online Status	Offline
Date Last Visited	‎09-30-2021 01:37 PM

_time need to be pick from log middle entry

How to configure inputs.conf to forward PingFedera...

Monitoring Splunk logs for alert delete

How to concatenate a string with a value containin...

Where does forwarded data exist if the index menti...

How to search and set up an alert displaying hosts...

Unexpected query string parameters: form in Drilld...

Passing Variable from one view to other view

Field extraction taking whole event as field

How Splunk DB manages data which has record of sam...

Re: _time need to be pick from log middle entry

Re: _time need to be pick from log middle entry

Re: _time need to be pick from log middle entry

_time need to be pick from log middle entry

How to configure inputs.conf to forward PingFedera...

Re: Monitoring Splunk logs for alert delete

Monitoring Splunk logs for alert delete

Re: How to concatenate a string with a value conta...

Re: How to concatenate a string with a value conta...

Re: How to concatenate a string with a value conta...

Re: How to concatenate a string with a value conta...

How to concatenate a string with a value containin...

Re: Where does forwarded data exist if the index m...

Where does forwarded data exist if the index menti...

Re: How to search and set up an alert displaying h...

Re: How to search and set up an alert displaying h...

Re: How to search and set up an alert displaying h...

How to search and set up an alert displaying hosts...

Unexpected query string parameters: form in Drilld...

Re: Passing Variable from one view to other view

Re: Passing Variable from one view to other view

Passing Variable from one view to other view

Re: Field extraction taking whole event as field

Field extraction taking whole event as field

Re: How Splunk DB manages data which has record of...